CVE-2026-107294
medium
CVSS v3
6.5
CVSS v4 NEW
—
VIR risk
6.5
Description
Pydantic AI: Unbounded memory use when downloading remote content via web_fetch or FileUrl
Predictions
Exploit likelihood
75%
Patch ETA
—
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
No mitigations published for this CVE yet.
The vendor-content worker queues fetches as references arrive (check back in a few minutes). Or — if you've already worked around this in production — publish your fix to the community-verified tier.
Propose a mitigation on Community Mitigations published via the community go through AI scoring + 2 human reviewers + 7-day silent objection window before landing here withsource_tier=community-verified.
Package impact
| Ecosystem | Package | Vulnerable | Fixed |
|---|---|---|---|
| PyPI | pydantic-ai | >=1.77.0,<1.107.2 | 1.107.2 |
| PyPI | pydantic-ai | >=2.0.0b1,<2.24.0 | 2.24.0 |
| PyPI | pydantic-ai-slim | >=1.77.0,<1.107.2 | 1.107.2 |
| PyPI | pydantic-ai-slim | >=2.0.0b1,<2.24.0 | 2.24.0 |
References
- https://github.com/pydantic/pydantic-ai/commit/7a64d049c3f5271a975cd1d64b2fa876d83ede1d
- https://github.com/pydantic/pydantic-ai/commit/e3824a58c82864ed26afb2887619834a4eb86cc8
- https://github.com/pydantic/pydantic-ai/pull/7141
- https://github.com/pydantic/pydantic-ai/pull/7308
- https://github.com/pydantic/pydantic-ai/releases/tag/v1.107.2
- https://github.com/pydantic/pydantic-ai/releases/tag/v2.24.0
- https://github.com/pydantic/pydantic-ai/security/advisories/GHSA-v2xh-2vp8-57h8
- https://github.com/pydantic/pydantic-ai
CWEs
CWE-400
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.